How to search all indexes with the specified HASH-es in a lookup file?

[evallja]

Hello,

I have created and imported a lookup file ex. "hashes.csv" and I have pasted there a list of 500+ hashes.

I want to search with index=* to see if I find any of these hashes in _raw field of any type of log.

Thank you in advance.

[ITWhisperer · Accepted solution]

Assuming the field in your csv is called hash, you could try something like this

index=* [|inputlookup hashes.csv | rename hash as query | fields query | format]

[evallja]

@ITWhisperer  It worked, thanks a lot!!!